mirror of
https://github.com/inspec/inspec
synced 2025-03-01 05:47:29 +00:00
33e148dae4
* Fix systemd path for Leap image
Signed-off-by: Jeremy JACQUE <jeremy.jacque@algolia.com>
* Use vhef client version 17 as doocker cookbook do not support >= 18
Signed-off-by: Jeremy JACQUE <jeremy.jacque@algolia.com>
* Add nftables resource
Signed-off-by: Jeremy JACQUE <jeremy.jacque@algolia.com>
* Add nftables tests
Signed-off-by: Jeremy JACQUE <jeremy.jacque@algolia.com>
* Add fixtures for nftables tests
Signed-off-by: Jeremy JACQUE <jeremy.jacque@algolia.com>
* enable nftables only when attr is true - then disable iptables
Signed-off-by: Jeremy JACQUE <jeremy.jacque@algolia.com>
* By default test iptables, not nftables
Signed-off-by: Jeremy JACQUE <jeremy.jacque@algolia.com>
* Fix tests and lint errors
Signed-off-by: Jeremy JACQUE <jeremy.jacque@algolia.com>
* Increase unit test coverage for nftables
Signed-off-by: Jeremy JACQUE <jeremy.jacque@algolia.com>
* Do not use -nn nft option as behaviour changes based on nft version
Signed-off-by: Jeremy JACQUE <jeremy.jacque@algolia.com>
* Base nft params identification on its version, not os version
Signed-off-by: Jeremy JACQUE <jeremy.jacque@algolia.com>
* Make test more human friendly by reversing unless/if logic
Signed-off-by: Jeremy JACQUE <jeremy.jacque@algolia.com>
* Update mocked cmds with nft params
Signed-off-by: Jeremy JACQUE <jeremy.jacque@algolia.com>
* Fix quoting issue with rubocop
Signed-off-by: Jeremy JACQUE <jeremy.jacque@algolia.com>
* Fix uninitiallized class vars
Signed-off-by: Jeremy JACQUE <jeremy.jacque@algolia.com>
* Fix unit test by adding nft version mocking
Signed-off-by: Jeremy JACQUE <jeremy.jacque@algolia.com>
* Clean nftables doc
Signed-off-by: Jeremy JACQUE <jeremy.jacque@algolia.com>
---------
Signed-off-by: Jeremy JACQUE <jeremy.jacque@algolia.com>
27 lines
1.2 KiB
Ruby
27 lines
1.2 KiB
Ruby
require "helper"
|
|
require "inspec/resource"
|
|
require "inspec/resources/nftables"
|
|
|
|
describe "Inspec::Resources::NfTables" do
|
|
|
|
# ubuntu
|
|
it "verify nftables chain on ubuntu" do
|
|
resource = MockLoader.new(:ubuntu).load_resource("nftables", { family: "inet", table: "filter", chain: "INPUT" })
|
|
_(resource.type).must_equal "filter"
|
|
_(resource.hook).must_equal "input"
|
|
_(resource.prio).must_equal 0
|
|
_(resource.policy).must_equal "accept"
|
|
_(resource.has_rule?('iifname "eth0" tcp dport 80 accept comment "http on 80"')).must_equal true
|
|
_(resource.has_rule?('iifname "eth1" tcp dport 80 accept')).must_equal false
|
|
_(resource.resource_id).must_equal "nftables (family: inet table: filter chain: INPUT )"
|
|
end
|
|
it "verify nftables set on ubuntu" do
|
|
resource = MockLoader.new(:ubuntu).load_resource("nftables", { family: "inet", table: "filter", set: "OPEN_PORTS" })
|
|
_(resource.type).must_equal "ipv4_addr"
|
|
_(resource.flags).must_include "interval"
|
|
_(resource.size).must_equal 65536
|
|
_(resource.has_element?("1.1.1.1")).must_equal true
|
|
_(resource.has_element?("2.2.2.2")).must_equal false
|
|
_(resource.resource_id).must_equal "nftables (family: inet table: filter set: OPEN_PORTS)"
|
|
end
|
|
end
|